Oracle Solaris Cryptographic Framework

The Oracle Solaris Cryptographic Framework provides a common store of algorithms and PKCS
#11 libraries to handle cryptographic requirements. The PKCS #11 libraries are implemented according
to the following standard: RSA Security Inc. PKCS #11 Cryptographic Token Interface (Cryptoki).

At the kernel level, the framework currently handles cryptographic requirements for Kerberos and
IPsec. User-level consumers include libsasl and IKE.

Export law in the United States requires that the use of open
cryptographic interfaces be restricted. The Oracle Solaris Cryptographic Framework satisfies the current law by
requiring that kernel cryptographic providers and PKCS #11 cryptographic providers be signed. For
further discussion, see Binary Signatures for Third-Party Software.

The framework enables providers of cryptographic services to have their services used by
many consumers in the Oracle Solaris OS. Another name for providers is plugins.
The framework allows three types of plugins:

User-level plugins – Shared objects that provide services by using PKCS #11 libraries, such as pkcs11_softtoken.so.1.

Kernel-level plugins – Kernel modules that provide implementations of cryptographic algorithms in software, such as AES.

Many of the algorithms in the framework are optimized for x86 with the SSE2 instruction set and for SPARC hardware.

Hardware plugins – Device drivers and their associated hardware accelerators. The Niagara chips, the ncp and n2cp device drivers, are one example. A hardware accelerator offloads expensive cryptographic functions from the operating system. The Sun Crypto Accelerator 6000 board is one example.